Download, upload, and read files.
nscurlnscurlSandbox: execFile · Timeout: 30s
security.defenseevasion.bypass network.commandandcontrol Download file: Download file and ignore cert checking
nscurl -k https://google.com -o /private/tmp/googleDownload file: Download file to the Downloads directory using -dl
nscurl https://google.com -dlDownload file: Download file to a designated directory using -dir
nscurl https://google.com -dir /private/tmp/google| Type | Rule / Indicator |
|---|---|
| other | https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/all_curl_activity Jamf Protect: Detect all curl and nscurl activity |
| other | https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/file_download_curl_insecure Jamf Protect: Detect file downloads using the insecure argument for curl and nscurl |
| sigma | https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_nscurl_usage.yml Sigma: File Download Via Nscurl - MacOS |
macOS version of curl that is used to download files to a target without applying the quarantine extended attribute